The integrity of sensitive data is vital to the overall success of an enterprise. Unauthorized access to restricted data could risk an organization’s existence, so a strong, comprehensive policy is practically mandatory. This sample Data Classification Policy offers a framework and set of procedures to help your organization safeguard its data.

From the policy:

Introduction
The combination of big data, the Internet of Things (IoT), and cloud computing have created an organizational environment where large amounts of sensitive data must be collected and must be protected. When malicious criminals breach security systems, it is so they can steal valuable data—because they know access to sensitive data is worth more than mere money.

For this reason, it is imperative that organizations protect their data. But resources are limited, so it is equally important that organizations define and classify sensitivity as data is collected. Sensitive data must be protected by every employee and every system of the enterprise, while public and non-sensitive data can be collected and managed with less stringent security protocols.

To help personnel and systems classify data, organizations should develop a comprehensive data classification policy that clearly defines data as it is collected and establishes the appropriate security protocols for each classification category. This data classification policy provides a foundation for you to develop guidelines that conform to your requirements.

Purpose
This policy establishes an enterprise-wide framework for categorizing and classifying all data created, collected, and stored during the daily operation of the company.

Scope
The framework outlined in this policy applies to every employee of the company, as well as to all contractors and third-party vendors who may come into contact with enterprise data. Any person granted authorized access to enterprise-controlled data is subject to the provisions of this policy.

Objective
Data plays a vital role in the success of this enterprise and must be protected and managed properly at all times depending on its classification. This policy establishes a functional framework for determining what data is classified as sensitive and how to secure that data during the normal course of business.